feat(relay): rendezvous-relay service — 7 packages + plans (contracts/transport/agent/control-plane/e2e/auth/web)

Multi-tenant reverse-tunnel service ("ngrok for Claude Code" with E2E): a
host-agent dials OUT to an operator-run relay; external devices reach the host
THROUGH the relay, routed by per-tenant subdomain, forwarding ciphertext only
(the relay never sees plaintext). Lets a customer reach their own self-hosted
web-terminal from anywhere with zero networking setup.

Packages — all tsc-strict + vitest green (656 tests), cross-package integration verified:
- relay-contracts: frozen shared contracts (mux frame codec, data model,
  capability token, E2E envelope, pairing) — the src/types.ts analog
- term-relay:   native WS mux + stateless data plane (subdomain routing, ciphertext forward)
- agent:        host-agent (pairing, per-host Ed25519 + mTLS dial-out, forwards to 127.0.0.1:3000)
- control-plane: accounts/hosts registry, pairing-code flow, routing table, provisioning
- relay-e2e:    browser<->agent E2E (X25519 ECDH through relay, AEAD, anti-replay, recoverable replay key)
- relay-auth:   Passkey/WebAuthn, capability tokens, per-host certs, deny-by-default tenant isolation
- relay-web:    browser login + Web Crypto E2E + client-side preview rendering

Security invariants INV1-15 enforced; cross-tenant isolation CI tripwire live
(.github/workflows/relay-tripwire.yml). Design + implementation-level plans in
docs/PLAN_RELAY_*.md and docs/EXPLORE_RELAY_SERVICE.md.

NOTE: generated autonomously per the reviewed plans. The security-critical
packages (relay-e2e, relay-auth) REQUIRE expert security audit before any real
deployment — passing tests prove self-consistency, not resistance to attackers.
Base app (src/, public/) unchanged; concurrent desktop work left uncommitted.

relay-web/src/add-machine.ts

@@ -0,0 +1,116 @@
+/**
+ * T6 (v0.9) — add-machine onboarding (pairing) from the browser's side (§4.5 ISSUE).
+ *
+ * `start()` requests a single-use, short-TTL pairing code (P3), displays the copy-paste command
+ * `npx web-terminal-agent pair <code>` and a countdown to `expiresAt`, then polls `listHosts` until
+ * a new host flips `●online` → fires `onPaired` ONCE. KPI: first-shell-in-under-2-minutes
+ * (EXPLORE §6). After `expiresAt` it shows "expired, generate a new code" and STOPS polling — the
+ * client never re-displays a redeemed/expired code, and never persists it (INV5: transient state).
+ */
+import type { ApiClient } from './api-client'
+import { ApiError } from './errors'
+
+const DEFAULT_POLL_MS = 3000
+const AGENT_PAIR_CMD = 'npx web-terminal-agent pair'
+
+export interface AddMachine {
+  start(): Promise<void>
+  dispose(): void
+}
+
+export interface AddMachineOpts {
+  readonly pollMs?: number
+  readonly onPaired?: (hostId: string) => void
+  /** Injectable clock for deterministic expiry tests; defaults to `Date.now`. */
+  readonly now?: () => number
+}
+
+export function mountAddMachine(root: HTMLElement, api: ApiClient, opts: AddMachineOpts = {}): AddMachine {
+  const pollMs = opts.pollMs ?? DEFAULT_POLL_MS
+  const now = opts.now ?? (() => Date.now())
+
+  const cmd = document.createElement('code')
+  cmd.className = 'pair-command'
+  const status = document.createElement('p')
+  status.className = 'pair-status'
+  status.setAttribute('role', 'status')
+  const error = document.createElement('p')
+  error.className = 'pair-error'
+  error.setAttribute('role', 'alert')
+  root.append(cmd, status, error)
+
+  let timer: ReturnType<typeof setInterval> | null = null
+  let disposed = false
+  let paired = false
+  let knownHostIds: ReadonlySet<string> = new Set()
+
+  function stopPolling(): void {
+    if (timer) {
+      clearInterval(timer)
+      timer = null
+    }
+  }
+
+  async function poll(expiresAtMs: number): Promise<void> {
+    if (disposed || paired) return
+    if (now() >= expiresAtMs) {
+      stopPolling()
+      status.textContent = 'Code expired — generate a new code.'
+      cmd.textContent = '' // never re-display an expired/redeemed code
+      return
+    }
+    try {
+      const hosts = await api.listHosts()
+      if (disposed || paired) return
+      const fresh = hosts.find((h) => h.status === 'online' && !knownHostIds.has(h.hostId))
+      if (fresh) {
+        paired = true
+        stopPolling()
+        status.textContent = `Paired: ${fresh.subdomain} is online.`
+        opts.onPaired?.(fresh.hostId)
+      }
+    } catch (err) {
+      // A transient poll error is non-fatal; the loop retries until expiry (no infinite hang).
+      error.textContent =
+        err instanceof ApiError ? `Status check failed (${err.kind}).` : 'Status check failed.'
+    }
+  }
+
+  async function start(): Promise<void> {
+    error.textContent = ''
+    // Snapshot existing hosts so we detect the NEW one that pairs in.
+    try {
+      knownHostIds = new Set((await api.listHosts()).map((h) => h.hostId))
+    } catch {
+      knownHostIds = new Set()
+    }
+
+    let code: string
+    let expiresAt: string
+    try {
+      const issued = await api.requestPairingCode()
+      code = issued.code
+      expiresAt = issued.expiresAt
+    } catch (err) {
+      error.textContent =
+        err instanceof ApiError ? `Could not issue a code (${err.kind}).` : 'Could not issue a code.'
+      return
+    }
+
+    cmd.textContent = `${AGENT_PAIR_CMD} ${code}` // textContent-only, no injection
+    status.textContent = 'Waiting for the host to pair…'
+    const expiresAtMs = Date.parse(expiresAt)
+
+    stopPolling()
+    timer = setInterval(() => void poll(expiresAtMs), pollMs)
+    void poll(expiresAtMs)
+  }
+
+  return {
+    start,
+    dispose(): void {
+      disposed = true
+      stopPolling()
+    },
+  }
+}